1{
 2  inputs = {
 3    naersk.url = "github:nix-community/naersk/master";
 4    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
 5    utils.url = "github:numtide/flake-utils";
 6  };
 7
 8  outputs = { self, nixpkgs, utils, naersk }:
 9    utils.lib.eachDefaultSystem (system:
10      let
11        pkgs = import nixpkgs { inherit system; };
12        naersk-lib = pkgs.callPackage naersk { };
13      in
14      {
15        defaultPackage = naersk-lib.buildPackage {
16          root = ./.;
17          nativeBuildInputs = with pkgs; [ pkg-config ];
18          buildInputs = with pkgs; [ openssl ];
19        };
20        devShell = with pkgs; mkShell {
21          buildInputs = [ cargo rustc rustfmt pre-commit rustPackages.clippy ];
22          RUST_SRC_PATH = rustPlatform.rustLibSrc;
23        };
24
25        nixosModules.default = { config, lib, pkgs, ... }:
26        with lib;
27        let
28          cfg = config.services.rgit;
29        in
30        {
31          options.services.rgit = {
32            enable = mkEnableOption "rgit";
33            bindAddress = mkOption {
34              default = "[::]:8333";
35              description = "Address and port to listen on";
36              type = types.str;
37            };
38            dbStorePath = mkOption {
39              default = "/tmp/rgit.db";
40              description = "Path to store the temporary cache";
41              type = types.path;
42            };
43            repositoryStorePath = mkOption {
44              default = "/git";
45              description = "Path to repositories";
46              type = types.path;
47            };
48          };
49
50          config = mkIf cfg.enable {
51            users.groups.rgit = { };
52            users.users.rgit = {
53              description = "RGit service user";
54              group = "rgit";
55              isSystemUser = true;
56              home = "/git";
57            };
58
59            systemd.services.rgit = {
60              enable = true;
61              wantedBy = [ "multi-user.target" ];
62              after = [ "network-online.target" ];
63              path = [ pkgs.git ];
64              serviceConfig = {
65                Type = "exec";
66                ExecStart = "${self.defaultPackage."${system}"}/bin/rgit --db-store ${cfg.dbStorePath} ${cfg.bindAddress} ${cfg.repositoryStorePath}";
67                Restart = "on-failure";
68
69                User = "rgit";
70                Group = "rgit";
71
72                CapabilityBoundingSet = "";
73                NoNewPrivileges = true;
74                PrivateDevices = true;
75                PrivateTmp = true;
76                PrivateUsers = true;
77                PrivateMounts = true;
78                ProtectHome = true;
79                ProtectClock = true;
80                ProtectProc = "noaccess";
81                ProcSubset = "pid";
82                ProtectKernelLogs = true;
83                ProtectKernelModules = true;
84                ProtectKernelTunables = true;
85                ProtectControlGroups = true;
86                ProtectHostname = true;
87                RestrictSUIDSGID = true;
88                RestrictRealtime = true;
89                RestrictNamespaces = true;
90                LockPersonality = true;
91                RemoveIPC = true;
92                RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
93                SystemCallFilter = [ "@system-service" "~@privileged" ];
94              };
95            };
96          };
97        };
98      });
99}